import{a as R}from"./chunk-3T4EOSMQ.js";import{b as O,c as H,d as y,g as E,h as A}from"./chunk-WI7DO2VU.js";import{a as K,b as c}from"./chunk-TX7AAHER.js";import"./chunk-FSRPMVAS.js";var p=class e extends K{name="TokenProviderError";constructor(o,s=!0){super(o,s),Object.setPrototypeOf(this,e.prototype)}};var j=e=>e&&(typeof e.sso_start_url=="string"||typeof e.sso_account_id=="string"||typeof e.sso_session=="string"||typeof e.sso_region=="string"||typeof e.sso_role_name=="string");var u="To refresh this SSO session run 'aws sso login' with the corresponding profile.";var U=async(e,o={},s)=>{let{SSOOIDCClient:t}=await import("./sso-oidc-33SS76HS.js"),n=f=>o.clientConfig?.[f]??o.parentClientConfig?.[f]??s?.[f];return new t(Object.assign({},o.clientConfig??{},{region:e??o.clientConfig?.region,logger:n("logger"),userAgentAppId:n("userAgentAppId")}))};var q=async(e,o,s={},t)=>{let{CreateTokenCommand:n}=await import("./sso-oidc-33SS76HS.js");return(await U(o,s,t)).send(new n({clientId:e.clientId,clientSecret:e.clientSecret,refreshToken:e.refreshToken,grantType:"refresh_token"}))};var P=e=>{if(e.expiration&&e.expiration.getTime()<Date.now())throw new p(`Token is expired. ${u}`,!1)};var d=(e,o,s=!1)=>{if(typeof o>"u")throw new p(`Value not present for '${e}' in SSO Token${s?". Cannot refresh":""}. ${u}`,!1)};import{promises as Y}from"fs";var{writeFile:B}=Y,W=(e,o)=>{let s=H(e),t=JSON.stringify(o,null,2);return B(s,t)};var X=new Date(0),z=(e={})=>async({callerClientConfig:o}={})=>{e.logger?.debug("@aws-sdk/token-providers - fromSso");let s=await A(e),t=O({profile:e.profile??o?.profile}),n=s[t];if(n){if(!n.sso_session)throw new p(`Profile '${t}' is missing required property 'sso_session'.`)}else throw new p(`Profile '${t}' could not be found in shared credentials file.`,!1);let a=n.sso_session,g=(await E(e))[a];if(!g)throw new p(`Sso session '${a}' could not be found in shared credentials file.`,!1);for(let i of["sso_start_url","sso_region"])if(!g[i])throw new p(`Sso session '${a}' is missing required property '${i}'.`,!1);let S=g.sso_start_url,x=g.sso_region,r;try{r=await y(a)}catch{throw new p(`The SSO session token associated with profile=${t} was not found or is invalid. ${u}`,!1)}d("accessToken",r.accessToken),d("expiresAt",r.expiresAt);let{accessToken:_,expiresAt:k}=r,l={token:_,expiration:new Date(k)};if(l.expiration.getTime()-Date.now()>3e5)return l;if(Date.now()-X.getTime()<30*1e3)return P(l),l;d("clientId",r.clientId,!0),d("clientSecret",r.clientSecret,!0),d("refreshToken",r.refreshToken,!0);try{X.setTime(Date.now());let i=await q(r,x,e,o);d("accessToken",i.accessToken),d("expiresIn",i.expiresIn);let m=new Date(Date.now()+i.expiresIn*1e3);try{await W(a,{...r,accessToken:i.accessToken,expiresAt:m.toISOString(),refreshToken:i.refreshToken})}catch{}return{token:i.accessToken,expiration:m}}catch{return P(l),l}};var T=!1,v=async({ssoStartUrl:e,ssoSession:o,ssoAccountId:s,ssoRegion:t,ssoRoleName:n,ssoClient:a,clientConfig:f,parentClientConfig:g,callerClientConfig:S,profile:x,filepath:r,configFilepath:_,ignoreCache:k,logger:l})=>{let i,m="To refresh this SSO session run aws sso login with the corresponding profile.";if(o)try{let w=await z({profile:x,filepath:r,configFilepath:_,ignoreCache:k})();i={accessToken:w.token,expiresAt:new Date(w.expiration).toISOString()}}catch(w){throw new c(w.message,{tryNextLink:T,logger:l})}else try{i=await y(e)}catch{throw new c(`The SSO session associated with this profile is invalid. ${m}`,{tryNextLink:T,logger:l})}if(new Date(i.expiresAt).getTime()-Date.now()<=0)throw new c(`The SSO session associated with this profile has expired. ${m}`,{tryNextLink:T,logger:l});let{accessToken:I}=i,{SSOClient:h,GetRoleCredentialsCommand:C}=await import("./loadSso-PT5GF7HH.js"),V=a||new h(Object.assign({},f??{},{logger:f?.logger??S?.logger??g?.logger,region:f?.region??t,userAgentAppId:f?.userAgentAppId??S?.userAgentAppId??g?.userAgentAppId})),D;try{D=await V.send(new C({accountId:s,roleName:n,accessToken:I}))}catch(w){throw new c(w,{tryNextLink:T,logger:l})}let{roleCredentials:{accessKeyId:F,secretAccessKey:$,sessionToken:L,expiration:b,credentialScope:M,accountId:G}={}}=D;if(!F||!$||!L||!b)throw new c("SSO returns an invalid temporary credential.",{tryNextLink:T,logger:l});let N={accessKeyId:F,secretAccessKey:$,sessionToken:L,expiration:new Date(b),...M&&{credentialScope:M},...G&&{accountId:G}};return o?R(N,"CREDENTIALS_SSO","s"):R(N,"CREDENTIALS_SSO_LEGACY","u"),N};var J=(e,o)=>{let{sso_start_url:s,sso_account_id:t,sso_region:n,sso_role_name:a}=e;if(!s||!t||!n||!a)throw new c(`Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", "sso_region", "sso_role_name", "sso_start_url". Got ${Object.keys(e).join(", ")}
Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`,{tryNextLink:!1,logger:o});return e};var $e=(e={})=>async({callerClientConfig:o}={})=>{e.logger?.debug("@aws-sdk/credential-provider-sso - fromSSO");let{ssoStartUrl:s,ssoAccountId:t,ssoRegion:n,ssoRoleName:a,ssoSession:f}=e,{ssoClient:g}=e,S=O({profile:e.profile??o?.profile});if(!s&&!t&&!n&&!a&&!f){let r=(await A(e))[S];if(!r)throw new c(`Profile ${S} was not found.`,{logger:e.logger});if(!j(r))throw new c(`Profile ${S} is not configured with SSO credentials.`,{logger:e.logger});if(r?.sso_session){let h=(await E(e))[r.sso_session],C=` configurations in profile ${S} and sso-session ${r.sso_session}`;if(n&&n!==h.sso_region)throw new c("Conflicting SSO region"+C,{tryNextLink:!1,logger:e.logger});if(s&&s!==h.sso_start_url)throw new c("Conflicting SSO start_url"+C,{tryNextLink:!1,logger:e.logger});r.sso_region=h.sso_region,r.sso_start_url=h.sso_start_url}let{sso_start_url:_,sso_account_id:k,sso_region:l,sso_role_name:i,sso_session:m}=J(r,e.logger);return v({ssoStartUrl:_,ssoSession:m,ssoAccountId:k,ssoRegion:l,ssoRoleName:i,ssoClient:g,clientConfig:e.clientConfig,parentClientConfig:e.parentClientConfig,callerClientConfig:e.callerClientConfig,profile:S,filepath:e.filepath,configFilepath:e.configFilepath,ignoreCache:e.ignoreCache,logger:e.logger})}else{if(!s||!t||!n||!a)throw new c('Incomplete configuration. The fromSSO() argument hash must include "ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"',{tryNextLink:!1,logger:e.logger});return v({ssoStartUrl:s,ssoSession:f,ssoAccountId:t,ssoRegion:n,ssoRoleName:a,ssoClient:g,clientConfig:e.clientConfig,parentClientConfig:e.parentClientConfig,callerClientConfig:e.callerClientConfig,profile:S,filepath:e.filepath,configFilepath:e.configFilepath,ignoreCache:e.ignoreCache,logger:e.logger})}};export{$e as fromSSO,j as isSsoProfile,J as validateSsoProfile};
